Analysis Overview
SHA256
1f79da2f9ff1f3c74540724b82ca29d0dba827d09b370b6b61d1c6add90311d5
Threat Level: Known bad
The file JaffaCakes118_074493a898c2a4d0d0b2c1e41864a942 was found to be: Known bad.
Malicious Activity Summary
Mofksys family
Pony family
Mofksys
Detects Mofksys worm
Modifies WinLogon for persistence
Modifies visiblity of hidden/system files in Explorer
Pony,Fareit
Boot or Logon Autostart Execution: Active Setup
Executes dropped EXE
Drops startup file
Adds Run key to start application
Suspicious use of SetThreadContext
Drops file in Windows directory
System Location Discovery: System Language Discovery
Unsigned PE
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
MITRE ATT&CK
Enterprise Matrix V16
Analysis: static1
Detonation Overview
Reported
2025-05-20 12:08
Signatures
Pony family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2025-05-20 12:08
Reported
2025-05-20 12:11
Platform
win10v2004-20250502-en
Max time kernel
150s
Max time network
136s
Command Line
Signatures
Detects Mofksys worm
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Modifies WinLogon for persistence
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" | \??\c:\windows\system\explorer.exe | N/A |
Modifies visiblity of hidden/system files in Explorer
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3674642747-2260306818-3009887879-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" | \??\c:\windows\system\explorer.exe | N/A |
Mofksys
Mofksys family
Pony family
Pony,Fareit
Boot or Logon Autostart Execution: Active Setup
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} | \??\c:\windows\system\explorer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" | \??\c:\windows\system\explorer.exe | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JaffaCakes118_074493a898c2a4d0d0b2c1e41864a942.exe | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_074493a898c2a4d0d0b2c1e41864a942.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JaffaCakes118_074493a898c2a4d0d0b2c1e41864a942.exe | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_074493a898c2a4d0d0b2c1e41864a942.exe | N/A |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.exe | \??\c:\windows\system\explorer.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.exe | \??\c:\windows\system\explorer.exe | N/A |
Executes dropped EXE
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" | \??\c:\windows\system\explorer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" | \??\c:\windows\system\explorer.exe | N/A |
Suspicious use of SetThreadContext
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\explorer.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | \??\c:\windows\system\explorer.exe | \??\c:\windows\system\explorer.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\explorer.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\explorer.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\explorer.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\explorer.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_074493a898c2a4d0d0b2c1e41864a942.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\explorer.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | \??\c:\windows\system\spoolsv.exe | \??\c:\windows\system\explorer.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\explorer.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\explorer.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\explorer.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\explorer.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\explorer.exe | N/A |
| File opened for modification | \??\c:\windows\system\explorer.exe | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_074493a898c2a4d0d0b2c1e41864a942.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\explorer.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\system\udsys.exe | \??\c:\windows\system\explorer.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\explorer.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_074493a898c2a4d0d0b2c1e41864a942.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_074493a898c2a4d0d0b2c1e41864a942.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_074493a898c2a4d0d0b2c1e41864a942.exe"
C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_074493a898c2a4d0d0b2c1e41864a942.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_074493a898c2a4d0d0b2c1e41864a942.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\system\explorer.exe RO
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\system\svchost.exe RO
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe RO
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
Network
| Country | Destination | Domain | Proto |
| IE | 95.100.98.83:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| GB | 216.58.201.99:80 | c.pki.goog | tcp |
Files
memory/2276-0-0x0000000002360000-0x0000000002361000-memory.dmp
C:\Windows\Parameters.ini
| MD5 | 6687785d6a31cdf9a5f80acb3abc459b |
| SHA1 | 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9 |
| SHA256 | 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b |
| SHA512 | 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962 |
memory/2276-32-0x0000000002360000-0x0000000002361000-memory.dmp
memory/2276-31-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/1968-35-0x0000000000400000-0x000000000043E000-memory.dmp
memory/1968-36-0x0000000000400000-0x000000000043E000-memory.dmp
memory/2276-39-0x0000000000400000-0x00000000005D3000-memory.dmp
C:\Windows\System\explorer.exe
| MD5 | e4395245496187a66c975354c7402537 |
| SHA1 | 33acc01703b4b9487d465830ddd5e1ead9d040c9 |
| SHA256 | 3c4b04485ffa87f1b0af30b77fab25b6cedae847e412cfb8a4e243087f9c726d |
| SHA512 | db722f041205bd39c63cd21f2300e0adad10cfb135aff0d6703aa898e66af568ca533f9833fc2d2ef02ee71369229431d2a3b8f96def23e3210648eebdd5fce6 |
memory/1968-63-0x0000000000440000-0x0000000000509000-memory.dmp
memory/1968-65-0x0000000000400000-0x000000000043E000-memory.dmp
memory/4888-71-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/1152-76-0x0000000000400000-0x000000000043E000-memory.dmp
memory/4888-77-0x0000000000400000-0x00000000005D3000-memory.dmp
C:\Windows\System\spoolsv.exe
| MD5 | 5a2aa75f2d381f91a9f7195f475e1f2e |
| SHA1 | 48a8aa44a755423145b445686d4cda0e66eebe34 |
| SHA256 | 85312d32a02eabfaeda602ffe4d94d61f94f6abfc29a5f9bf89f89a8c64a2531 |
| SHA512 | f3245dc4ac266f55b89ce88fa08e20cb3ca93b7759d88b149287a72671ba39a798ce24deb151a98cc585af5a5566e340f7441d65ab7e5b2e05413cb5e54cfcbb |
C:\Windows\Parameters.ini
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
memory/1152-658-0x0000000000400000-0x000000000043E000-memory.dmp
memory/1164-720-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/456-853-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/4328-854-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/3696-910-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/1512-1031-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/4228-1117-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/2192-1188-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/3388-1244-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/4688-1300-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/4620-1372-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/3004-1429-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/2616-1495-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/1160-1553-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/1200-1625-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/2488-1687-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/1520-1688-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/868-1765-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/4588-1842-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/2140-1909-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/4544-1971-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/1164-1978-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/3576-1977-0x0000000000400000-0x000000000043E000-memory.dmp
memory/4768-1987-0x0000000000400000-0x000000000043E000-memory.dmp
memory/1600-1986-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/456-1989-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/4328-1994-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/2032-2000-0x0000000000400000-0x000000000043E000-memory.dmp
memory/2316-2006-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/3164-2007-0x0000000000400000-0x000000000043E000-memory.dmp
memory/3696-2009-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/2876-2018-0x0000000000400000-0x000000000043E000-memory.dmp
memory/3576-2073-0x0000000000400000-0x000000000043E000-memory.dmp
memory/4000-2155-0x0000000000400000-0x000000000043E000-memory.dmp
memory/4056-2167-0x0000000000400000-0x000000000043E000-memory.dmp
memory/1920-2267-0x0000000000400000-0x000000000043E000-memory.dmp
memory/3844-2280-0x0000000000400000-0x000000000043E000-memory.dmp
memory/3636-2295-0x0000000000400000-0x000000000043E000-memory.dmp
memory/4332-2304-0x0000000000400000-0x000000000043E000-memory.dmp
memory/1980-2382-0x0000000000400000-0x000000000043E000-memory.dmp
memory/2132-2401-0x0000000000400000-0x000000000043E000-memory.dmp
memory/4748-2409-0x0000000000400000-0x000000000043E000-memory.dmp
memory/4748-2413-0x0000000000400000-0x000000000043E000-memory.dmp
memory/392-2422-0x0000000000400000-0x000000000043E000-memory.dmp
memory/392-2425-0x0000000000400000-0x000000000043E000-memory.dmp
memory/1980-2537-0x0000000000400000-0x000000000043E000-memory.dmp
memory/920-2560-0x0000000000400000-0x000000000043E000-memory.dmp
memory/1376-2572-0x0000000000400000-0x000000000043E000-memory.dmp
memory/1376-2569-0x0000000000400000-0x000000000043E000-memory.dmp
memory/3648-2737-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5056-2758-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5056-2755-0x0000000000400000-0x000000000043E000-memory.dmp
memory/2300-2827-0x0000000000400000-0x000000000043E000-memory.dmp
memory/3648-2881-0x0000000000400000-0x000000000043E000-memory.dmp
memory/384-2906-0x0000000000400000-0x000000000043E000-memory.dmp
memory/2248-2914-0x0000000000400000-0x000000000043E000-memory.dmp
memory/2248-2917-0x0000000000400000-0x000000000043E000-memory.dmp
memory/4988-2924-0x0000000000400000-0x000000000043E000-memory.dmp
memory/384-3025-0x0000000000400000-0x000000000043E000-memory.dmp
memory/2548-3056-0x0000000000400000-0x000000000043E000-memory.dmp
memory/428-3074-0x0000000000400000-0x000000000043E000-memory.dmp
memory/428-3077-0x0000000000400000-0x000000000043E000-memory.dmp
memory/4036-3162-0x0000000000400000-0x000000000043E000-memory.dmp
memory/2220-3207-0x0000000000400000-0x000000000043E000-memory.dmp
memory/2220-3281-0x0000000000400000-0x000000000043E000-memory.dmp
memory/1524-3469-0x0000000000400000-0x000000000043E000-memory.dmp
memory/100-3609-0x0000000000400000-0x000000000043E000-memory.dmp
memory/712-3617-0x0000000000400000-0x000000000043E000-memory.dmp
memory/4140-3628-0x0000000000400000-0x000000000043E000-memory.dmp
memory/712-3733-0x0000000000400000-0x000000000043E000-memory.dmp
memory/448-3750-0x0000000000400000-0x000000000043E000-memory.dmp
memory/1152-3755-0x0000000000400000-0x000000000043E000-memory.dmp
memory/1940-3762-0x0000000000400000-0x000000000043E000-memory.dmp
memory/4276-4026-0x0000000000400000-0x000000000043E000-memory.dmp
memory/740-4036-0x0000000000400000-0x000000000043E000-memory.dmp
memory/4276-4122-0x0000000000400000-0x000000000043E000-memory.dmp
memory/3000-4228-0x0000000000400000-0x000000000043E000-memory.dmp
memory/4296-4238-0x0000000000400000-0x000000000043E000-memory.dmp
memory/3000-4295-0x0000000000400000-0x000000000043E000-memory.dmp
memory/3884-4371-0x0000000000400000-0x000000000043E000-memory.dmp
memory/4144-4516-0x0000000000400000-0x000000000043E000-memory.dmp
memory/1844-4587-0x0000000000400000-0x000000000043E000-memory.dmp
memory/4168-4597-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5272-4713-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5448-4725-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5588-4743-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5648-4750-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5648-4754-0x0000000000400000-0x000000000043E000-memory.dmp
memory/6012-4835-0x0000000000400000-0x000000000043E000-memory.dmp
memory/6012-4831-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5548-4984-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5620-4994-0x0000000000400000-0x000000000043E000-memory.dmp
memory/4996-5003-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5548-5105-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5316-5200-0x0000000000400000-0x000000000043E000-memory.dmp
memory/2372-5352-0x0000000000400000-0x000000000043E000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2025-05-20 12:08
Reported
2025-05-20 12:11
Platform
win11-20250502-en
Max time kernel
130s
Max time network
103s
Command Line
Signatures
Detects Mofksys worm
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Modifies WinLogon for persistence
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" | \??\c:\windows\system\explorer.exe | N/A |
Modifies visiblity of hidden/system files in Explorer
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1245416451-815278583-4285364870-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" | \??\c:\windows\system\explorer.exe | N/A |
Mofksys
Mofksys family
Pony family
Pony,Fareit
Boot or Logon Autostart Execution: Active Setup
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" | \??\c:\windows\system\explorer.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} | \??\c:\windows\system\explorer.exe | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JaffaCakes118_074493a898c2a4d0d0b2c1e41864a942.exe | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_074493a898c2a4d0d0b2c1e41864a942.exe | N/A |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.exe | \??\c:\windows\system\explorer.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.exe | \??\c:\windows\system\explorer.exe | N/A |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JaffaCakes118_074493a898c2a4d0d0b2c1e41864a942.exe | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_074493a898c2a4d0d0b2c1e41864a942.exe | N/A |
Executes dropped EXE
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" | \??\c:\windows\system\explorer.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" | \??\c:\windows\system\explorer.exe | N/A |
Suspicious use of SetThreadContext
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File opened for modification | \??\c:\windows\system\explorer.exe | \??\c:\windows\system\explorer.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_074493a898c2a4d0d0b2c1e41864a942.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | \??\c:\windows\system\explorer.exe | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_074493a898c2a4d0d0b2c1e41864a942.exe | N/A |
| File opened for modification | \??\c:\windows\system\spoolsv.exe | \??\c:\windows\system\explorer.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\explorer.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\explorer.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\explorer.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\system\udsys.exe | \??\c:\windows\system\explorer.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\explorer.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\explorer.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\explorer.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\explorer.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\explorer.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\spoolsv.exe | N/A |
| File opened for modification | C:\Windows\Parameters.ini | \??\c:\windows\system\explorer.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_074493a898c2a4d0d0b2c1e41864a942.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\windows\system\spoolsv.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | \??\c:\windows\system\explorer.exe | N/A |
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_074493a898c2a4d0d0b2c1e41864a942.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_074493a898c2a4d0d0b2c1e41864a942.exe"
C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_074493a898c2a4d0d0b2c1e41864a942.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_074493a898c2a4d0d0b2c1e41864a942.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\system\explorer.exe RO
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\system\svchost.exe RO
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe RO
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
Network
Files
memory/5244-0-0x0000000002480000-0x0000000002481000-memory.dmp
C:\Windows\Parameters.ini
| MD5 | 6687785d6a31cdf9a5f80acb3abc459b |
| SHA1 | 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9 |
| SHA256 | 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b |
| SHA512 | 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962 |
memory/5244-37-0x0000000002480000-0x0000000002481000-memory.dmp
memory/5244-36-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/5072-39-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5072-40-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5244-45-0x0000000000400000-0x00000000005D3000-memory.dmp
C:\Windows\System\explorer.exe
| MD5 | 1fcf577c5c0c70a50d968de770eda1c2 |
| SHA1 | 77b5ec058b7efa06ea10b4e3e1e2b99fb0fc8bcd |
| SHA256 | 801d596c7f9499e9b5d17b43f5cd29a660bb5bec2ca1b7960b6a43e697e880b0 |
| SHA512 | 9352f4e28382059062770815e65ece3efd359657012effb34ad7ca49c6aacd1bac2335bafa4b1c1b6cc47b3a5e0453205e1c5a938107ef6ba29b423360381220 |
C:\Windows\Parameters.ini
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
memory/5072-58-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5092-89-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/5092-98-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/4128-94-0x0000000000400000-0x000000000043E000-memory.dmp
C:\Windows\System\spoolsv.exe
| MD5 | afe3518bddd580d180d68b3f55aa70f7 |
| SHA1 | b260c6002113e0ac78e065b1e09fae71f1f0ee2e |
| SHA256 | c571fb14452fc2f9b305cb0d37861739d471bd1e2e5da89be450aa8b51cb2f0e |
| SHA512 | c96f82ff706469b77801d540170818298c4fd00088827893ca352cb9cf461542c28654c4702b6d3d5faeb756f2f14c6051d2a088ed1c9ff40c8a78f747c348f6 |
memory/6060-600-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/4128-599-0x0000000000400000-0x000000000043E000-memory.dmp
memory/2984-636-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/5488-637-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/5584-693-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/2800-694-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/3148-710-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/2708-746-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/5528-747-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/1584-783-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/2712-817-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/3424-851-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/4296-852-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/2460-897-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/5904-948-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/4064-990-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/4364-1029-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/1240-1066-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/5124-1065-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/3852-1153-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/5680-1209-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/4764-1237-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/5148-1249-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/4572-1257-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/4452-1258-0x0000000000400000-0x000000000043E000-memory.dmp
memory/6060-1256-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/3720-1267-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5868-1266-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/2984-1269-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/5488-1274-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/2700-1273-0x0000000000400000-0x00000000005D3000-memory.dmp
memory/1136-1280-0x0000000000400000-0x000000000043E000-memory.dmp
memory/4856-1289-0x0000000000400000-0x000000000043E000-memory.dmp
memory/3916-1302-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5480-1313-0x0000000000400000-0x000000000043E000-memory.dmp
memory/468-1323-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5976-1342-0x0000000000400000-0x000000000043E000-memory.dmp
memory/952-1362-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5092-1388-0x0000000000400000-0x000000000043E000-memory.dmp
memory/3876-1398-0x0000000000400000-0x000000000043E000-memory.dmp
memory/1984-1417-0x0000000000400000-0x000000000043E000-memory.dmp
memory/2552-1428-0x0000000000400000-0x000000000043E000-memory.dmp
memory/4452-1448-0x0000000000400000-0x000000000043E000-memory.dmp
memory/4984-1474-0x0000000000400000-0x000000000043E000-memory.dmp
memory/3500-1527-0x0000000000400000-0x000000000043E000-memory.dmp
memory/4984-1552-0x0000000000400000-0x000000000043E000-memory.dmp
memory/232-1573-0x0000000000400000-0x000000000043E000-memory.dmp
memory/1292-1618-0x0000000000400000-0x000000000043E000-memory.dmp
memory/1292-1622-0x0000000000400000-0x000000000043E000-memory.dmp
memory/232-1640-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5132-1667-0x0000000000400000-0x000000000043E000-memory.dmp
memory/4796-1710-0x0000000000400000-0x000000000043E000-memory.dmp
memory/2420-1723-0x0000000000400000-0x000000000043E000-memory.dmp
memory/2420-1720-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5132-1772-0x0000000000400000-0x000000000043E000-memory.dmp
memory/6040-1816-0x0000000000400000-0x000000000043E000-memory.dmp
memory/4596-1824-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5932-1851-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5932-1854-0x0000000000400000-0x000000000043E000-memory.dmp
memory/2776-1896-0x0000000000400000-0x000000000043E000-memory.dmp
memory/904-1911-0x0000000000400000-0x000000000043E000-memory.dmp
memory/6012-1984-0x0000000000400000-0x000000000043E000-memory.dmp
memory/6136-1989-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5248-2029-0x0000000000400000-0x000000000043E000-memory.dmp
memory/1604-2389-0x0000000000400000-0x000000000043E000-memory.dmp
memory/1604-2442-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5160-2547-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5748-2610-0x0000000000400000-0x000000000043E000-memory.dmp
memory/4128-2622-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5648-2643-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5648-2657-0x0000000000400000-0x000000000043E000-memory.dmp
memory/1432-2660-0x0000000000400000-0x000000000043E000-memory.dmp
memory/4636-2686-0x0000000000400000-0x000000000043E000-memory.dmp
memory/2484-2737-0x0000000000400000-0x000000000043E000-memory.dmp
memory/1612-2817-0x0000000000400000-0x000000000043E000-memory.dmp
memory/1552-2854-0x0000000000400000-0x000000000043E000-memory.dmp
memory/2956-2961-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5656-2971-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5228-3084-0x0000000000400000-0x000000000043E000-memory.dmp
memory/864-3193-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5236-3203-0x0000000000400000-0x000000000043E000-memory.dmp
memory/6140-3213-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5824-3225-0x0000000000400000-0x000000000043E000-memory.dmp
memory/1048-3245-0x0000000000400000-0x000000000043E000-memory.dmp
memory/2632-3281-0x0000000000400000-0x000000000043E000-memory.dmp
memory/3948-3324-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5560-3377-0x0000000000400000-0x000000000043E000-memory.dmp
memory/2632-3385-0x0000000000400000-0x000000000043E000-memory.dmp
memory/4208-3441-0x0000000000400000-0x000000000043E000-memory.dmp
memory/4824-3458-0x0000000000400000-0x000000000043E000-memory.dmp
memory/4132-3465-0x0000000000400000-0x000000000043E000-memory.dmp
memory/4132-3469-0x0000000000400000-0x000000000043E000-memory.dmp
memory/4208-3526-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5720-3600-0x0000000000400000-0x000000000043E000-memory.dmp
memory/248-3695-0x0000000000400000-0x000000000043E000-memory.dmp
memory/4688-3705-0x0000000000400000-0x000000000043E000-memory.dmp